support SourceTextModule class

DataDog · Jan 15, 2025 · a6f076c · a6f076c
1 parent 2bfb603
commit a6f076c
Show file tree

Hide file tree

Showing 4 changed files with 185 additions and 122 deletions.
diff --git a/package.json b/package.json
@@ -19,7 +19,7 @@
     "test": "SERVICES=* yarn services && mocha --expose-gc 'packages/dd-trace/test/setup/node.js' 'packages/*/test/**/*.spec.js'",
     "test:appsec": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" \"packages/dd-trace/test/appsec/**/*.spec.js\"",
     "test:appsec:ci": "nyc --no-clean --include \"packages/dd-trace/src/appsec/**/*.js\" --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" -- npm run test:appsec",
-    "test:appsec:plugins": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/dd-trace/test/appsec/**/*.@($(echo $PLUGINS)).plugin.spec.js\"",
+    "test:appsec:plugins": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" --experimental-vm-modules \"packages/dd-trace/test/appsec/**/*.@($(echo $PLUGINS)).plugin.spec.js\"",
     "test:appsec:plugins:ci": "yarn services && nyc --no-clean --include \"packages/dd-trace/src/appsec/**/*.js\" -- npm run test:appsec:plugins",
     "test:debugger": "mocha -r 'packages/dd-trace/test/setup/mocha.js' 'packages/dd-trace/test/debugger/**/*.spec.js'",
     "test:debugger:ci": "nyc --no-clean --include 'packages/dd-trace/src/debugger/**/*.js' -- npm run test:debugger",

diff --git a/packages/datadog-instrumentations/src/vm.js b/packages/datadog-instrumentations/src/vm.js
@@ -5,6 +5,7 @@ const shimmer = require('../../datadog-shimmer')
 const names = ['vm', 'node:vm']
 
 const runScriptStartChannel = channel('datadog:vm:run-script:start')
+const sourceTextModuleStartChannel = channel('datadog:vm:source-text-module:start')
 
 addHook({ name: names }, function (vm) {
   vm.Script = class extends vm.Script {
@@ -17,6 +18,16 @@ addHook({ name: names }, function (vm) {
     }
   }
 
+  vm.SourceTextModule = class extends vm.SourceTextModule {
+    constructor (sourceText) {
+      super(...arguments)
+
+      if (sourceTextModuleStartChannel.hasSubscribers && sourceText) {
+        sourceTextModuleStartChannel.publish({ sourceText })
+      }
+    }
+  }
+
   shimmer.wrap(vm, 'runInContext', wrapVMMethod)
   shimmer.wrap(vm, 'runInNewContext', wrapVMMethod)
   shimmer.wrap(vm, 'runInThisContext', wrapVMMethod)

diff --git a/packages/dd-trace/src/appsec/iast/analyzers/code-injection-analyzer.js b/packages/dd-trace/src/appsec/iast/analyzers/code-injection-analyzer.js
@@ -11,6 +11,7 @@ class CodeInjectionAnalyzer extends InjectionAnalyzer {
   onConfigure () {
     this.addSub('datadog:eval:call', ({ script }) => this.analyze(script))
     this.addSub('datadog:vm:run-script:start', ({ code }) => this.analyze(code))
+    this.addSub('datadog:vm:source-text-module:start', ({ sourceText }) => this.analyze(sourceText))
   }
 
   _areRangesVulnerable () {